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Agenda 

(U) 

• (U//FOUO) What is AURORAGOLD? 

• (U) Why come to us? 

• (U) Our value proposition... 

— (S//SI//REL) Primary source mobile network information 

— (S//SI//REL) First-hand insight into industry changes 

• (U//FOUO) Targeting efforts 

• (U) Notable successes 

• (U) Future plans 

• (U) Discussion! 
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What is AURORAGOLD? 

(U//FOUO) 




(U) Team of analysts, developers, and wireless SMEs working on: 



• (S//SI//REL) Database of 
Mobile Network Operators 
(MNOs), networks, and 
PWlDs from collected 
GSM/UMTS/LTE roaming 
documents (IR.21s) 



• (S//SI//REL) Target 

development effort against 
MNOs, roaming hubs, and 
working groups 



• (U) Fusion of open source, commercial data 
with SIGINT to answer wireless needs 
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Why come to us? 

(U)_ 

• (S//SI//REL) Extensive, global IR.21 data vetted by 
SSG4 analysts: 

— 701 networks of estimated 985 (as of 15 May 2012) 

— First-hand SIGINT information direct from MNOs 

• (S//SI//REL) Most comprehensive set of IR.21-related 
email selectors and keyword-based tasking: 

— 1201 actively managed email selectors (as of 15 May 2012) 

• (U//FOUO) Foundation for worldwide mobile wireless 
network trending and forecasting 

— Includes visibility into changing industry standards and practices 
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How can we help you? 




(S//SI//REL) Example: “AFRICOM IKD 
OPS requires information concerning 
the SMS Gateway domains for: 
Libyana mobile (libyana.ly) and Al 
Madar Al Jadid (almadar.ly). We 
believe these are the only two mobile 
providers in Libya but if you have 
information to the contrary please let 
us know.” 



3 March 2011 



Jgoson < fl'ilrtill ULllxI 

LIBYANA MOBILE PHONE 





Submit 

Global Tip 
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We've done the research 




• (S//SI//REL) Quickly identified collected IR.21s 

• (U//FOUO) Pushed information out to 
customer through product reporting 



DOCN 000028528 
ZNY ZNY MMIVX 
ZKZK ZKZK RR SOL DE 
PDTG R 162037Z MAR 11 
FM FM DIRNSA 

CLAS TOPSECRET UMBRA US/UK/CAN/AUS/NZ EYES ONLY QQQQ 

XXMM XXMMENP01FOO11075 

SERI SERIAL: 3/OO/506998-11 

TAGS TAGS: LIC CCOM CLOG COEF CORG CPER CTEC CTPH LI 

SUBJ SUBJ: Libya/Telecommunications: Two Libyan Mobile Phone Companies 

Provide Updated Network information, June and December 2010 
(S//SI//REL TO USA, FVEY) 
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SIGINT Value - Al Madar IR.21 

(S//SI//REL) 





Extracted from 3/00/506998-11 
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SIGINT Value - Al Madar IR.21 



(S//SI//REL) 




Vendor Information 


BSS vendor(s) and SW/HW version: 


Ericsson 


HL R vendor(s) and SW/HW version: 


Ericsson 


MSC/VLR vendor(s) and SW/HW version: 


Ericsson 


SMSC vendors) and SW/HW version: 


Alcatel-Lucent V 3 .1 


SGSN vendors) and SW/HW version: 


Ericsson R7 


GGSN vendor(s) and SW/HW version: 


Ericsson R4 


MMSC vendor(s) and SW/HW version: 


Ericsson MMC 5.0 


IN vendor(s) and SW/HW version: 


Alcatel-Lucent 




GFK5 Llllo L Ull 



win 


UtMlEUlii 


Passwcrc 


ISP DNS Z? addles i (primary) 
ISP DWS IP addict, iVecundiav] 


WAP 


APN 


UGenKitii^ 


PilsiSWUld 


WAP Gateway EP address 


WAP Sender URL 


Port 


MMS 


APN 

Ubeiusiuae 


Pfl 3RUflY(i 


WAP Gateway TP address for MMS 


Meaia Sea \ ei L KL 


Fort 


GTP xrfsion 





GGSN 

ESS informs tiih: /c^m zrnal field) 





MMS Interworking Information 1 


Domain name of MMSC 




IP address range for MMSC 


IP address(es) of incoming MT A 


IP address(es) of outgoing MTA 


Max. size of MMS allowed 


Delivery Report allowed? 


Read Report allowed? 


Contact person(s) for IW MMS: (optional field) 


MMS IW Hub Providers) GT addresses: 


MM S IW Hub Providers) Name(s) : 
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IR.21s in AURORAGOLD 

(S//SI//REL) 




1.8.3 ROA MTNCi DATA B ASF. 



Operator name 


ALMADAR AL JADID 






Country 

(AJblfieviHlod iin-mduiy lu ISO 216*7). 


Li bya 
LEY 




j ROUTING INFORMATION 


CCITT E.lu4 Number stries: 


Country Code 
(CU) 


National Dt^tinarion C ode 
CMJQ 


MSISDN yunt ber rmieef ?>: 


218 


91 


Network nodes Global Tide 
numb vi rtnigefs}: ^ 


«* 


j 


““ c 


Mobile C ountry Code 
(MCC) 

_ 6116 


Mobile Network Code 
(MNQ 


1 2U VlnhiC Okil .ll 
Title: (MGT> 


fCQ 


(NCi 1 


21 S 


91 


Does; Number Portability apply 1 ? No 




International Roaming Coordinator: 



Eng. 

IR Coordinator 
T: 

Fax: 

Email: 




U alma daily 



Eng. 

IR Coordinator 
Fax : 

Email : Salmadar.lv 

Eng. 

IR Coordinator 

T: 

Fax: HHIBMIHHi 
Email: a a lma da r . 1 y 

Eng. 

IR Coordinator 
Fax: 

E ma il : Tv alma dar . i v 
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We monitor the industry 

(S//SI//REL) 

• (S//SI//REL) Visibility into changing standards 
and practices for: 

— Roaming 
— Signaling 
— Billing 

— Interoperability 

• GSM Association (GSMA), a Swiss association 
that drives the GSM/UMTS/LTE space 
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Roaming Agreement Exchange (RAEX) 

(S//SI//REL) 

• (U) Next-generation roaming exchange process 

• (U) Well-defined XML schemas instead of 
semi-structured data in multiple formats 

• (U) Email likely gives way to SSL sessions with 
central server(s) 





(S//SI//REL) 


SIGINT Access 


SIGINT Value 


Automated Analytics 


Old IR.21s 
RAEX IR.21S 


Easy 

Difficult 


Great 

Even greater! 


Nearly impossible 
Easy! 
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Targeting Efforts 



(U//FOUO) 




• (S//SI//REL) MNO roaming coordinators, hubs, 
GSMA working groups, ROAMSYS 

• (S//SI//REL) ~100% of MNOs in WPMO's Top 20 



Category 


Contains... 


4002 


IR21 senders/receivers 



3918 GSMA and SIGDEV 






XKEYSCORE 



Cadence 

Filtering & Seisdion Management 



Tag 


Contains... 


AGIR21 


IR21 senders/receivers 


AGJJSER 


Individual (usually sender) 


AG_ALIAS 


Alias (usually receiver) 


MCC/MNC [###][###] 


IR21 s/r for given network 


AGRAEX 


RAEX working groups 


roaming hub 


Roaming hub contacts 
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Email Address Selectors 

(S//SI//REL) 





UTT v$.l SPl - Task Selector Search 

Dynamic Page - Highest Possible Classification is TOP SECRET COMINT REL TO USA. AUS, CAN, GBR, NZL 
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Notable Successes 




• (TS//SI//REL) Characterization of IR.21 collection from 67 
high-priority networks (DSD) 

• (TS//SI//REL) Most recent IR.21s from Egypt (S2E) 

• (S//SI//REL) Assessment of IR.21 collection related to a 
possible new Chinese network (S2B) 

• (S//REL) Sole source of IR.21 collection, ingest, and 
processing for RONIN; >200% improvement (NAC) 

• (S//SI//REL) Working toward enterprise sharing of 
licensed, commercial data 

- Today: WiMAX data with JUBILEECORONA (S3516) 

• (TS//SI//REL) Reporting on GSMA standards and practices 
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Future Plans 

(U) 

• (S//SI//REL) RAEX IR.21 collection and ingest 
providing more query possibilities including: 

— LTE information 

— Technologies/Equipment 

— Frequencies 

• (S//SI//REL) AURORAGOLD user interface enabling 
SIGINT production chain access for querying and 
trending 

• (S//SI//REL) NKB partnership 
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Discussion 

(u) 

• (S//SI//REL) What are your ideas, suggestions, 
and analytic needs with respect to: 

• roaming and network information discovery and 
development? 

• GSMA's standards setting activities? 

• (S//SI//REL) What are we missing? Are there 
data elements we should seek out to help 
meet your needs? 
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Work with us! 

(U) 




• (U//FOUO) To contact the AURORAGOLD team 
with an RFI, please use GLOBAL TIPPER 



u 



goGI" 




• (U//FOUO) Wikilnfo: 

• (U//FOUO) Email: 



"wi AURORAGOLD" 
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(U//FOUO) AURORAGOLD 

(U) BACKUP SLIDES 
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AG/GSMA Reporting 



(S//SI//REL) 




Serial 


Topic 


3/00/506998-11 


(S//SI//REL) Libyan MNO information 


3/00/556211-11 


(S//SI//REL) Launch of RAEX; ROAMSYS and GSMA 


3/00/515656-12 


(S//SI//REL) GSMA standards releases/changes for 2012 
(RAEX IR.21 and others) 


2/00/502330-12 


(S//SI//REL) GSMA database of Type Allocation Codes (TACs) 
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GSMA Working Groups 

(S//SI//REL) 




Packet Working 
Group (PACKET) 



Signaling Working 
Party (SIGNAL) 



Roaming in 
LTE (RILTE) 



RAEX Testing 
Force (RAEXTF) 



O.f 
IP IT 

Fraud Forum 



Mi 

ft 

Terminal Steering 
Group (TSG) 



W 

Smart Card 
Group (SC AG) 



w 

Security Group 





W 

Inter-WorkJng Roaming 
Expert Group (I REG) 



Voice over 
LTE (VOLTE) 



Traffic Detail 
Subgroup (TDS) 




W 

Transferred Account 
Data Interchange 
Group (TADIG) 



Interconnect Working 
Group (IWG) 




ft 

Billing^ Accounting St 
Roaming Group (BARG) 




iLi, 



Task Force 
RAEX (TFRAEX) 





Roaming Hub Steering 
Group (RHSG) 



RING 



Agreements 

(AGREE) 



Roaming Charging 
Principles Group (RCPG) 



(U) Known as of 10 May 2012 



Technical Experts 
Conciliation Group (TECG) 



t Roaming Operational 

Billing Expert 

Agreement, Invoice St Group ( R0 BEG) 
Reference Data (AIR) 
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IR.21 Data Extraction 

(S//SI//REL) 




(U) Content 



Field 


AG 


R 


MCC/MNC 


X 


X 


Operator name 


X 


X 


Operator country 


X 


X 


Email addresses 


X 




Access point information 




X 


Autonomous system number 




X 


DNS names & IPs 




X 


Inter PLMN backbone IPs 




X 


GPRS Roaming Exchange (GRX) 




X 



(U) Metadata/SRI 



Field 


AG 


R 


SIGAD 


X 


X 


Case notation 


X 


X 


PWID 


X 


X 


PINWALE Date Time Group 


X 


X 


PIN WALE category & keywords 


X 




Email "From" & date 


X 




Source & destination IP 


X 




Filename 


X 




PDDG 




X 
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Metrics: Network Discovery 

(S//SI//REL) 




(S//SI//REL) GSM/UMTS/LTE Networks Discovered in SIGINT 



800 



700 



600 



500 



400 



300 



200 



100 



0 



□ 



— , ■ . M , I 



□ New Networks 

□ Confirmed Networks 



<§>' s>' s>' st s>' st st s>' s> s> s> nV *y *y *y ^ *y *y *y vy \y <y <y <y <y 

^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ 
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Metrics: Network Discovery 

(S//SI//REL) 




(S//SI//REL) GSM/UMTS/LTE Network 
Coverage 




(S//SI//REL) 

— 701 confirmed 

— 985 estimated 
-71% 



(as of 15 May 2012) 
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Network Coverage 



{S//SI//REL) 
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Metrics: Tasking 



(S//SI//REL) 




(S//SI//REL) Strong Selector Targeting 

1600 
1400 
1200 
1000 
800 
600 
400 
200 
0 

-200 



-400 - 


2011-11 


2011-12 


2012-01 


2012-02 


2012-03 


2012-04 


■ Net change in tasking 


363 


1 


782 


206 


2 


-143 


B Total tasked 


363 


364 


1146 


1352 


1354 


1211 


B Extracted from IR.21s 


564 


1040 


527 


517 


785 


711 
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RAEX Adoption inSIGINT 

(S//SI//REL) 




(S//SI//REL) What we've seen so far... 




(S//SI//REL) 36/699 networks 

(Apr 2012; AURORAGOLD) 



(TS//SI//REL) What we expect... 




(TS//SI//REL) 202/985 networks 

(19 Apr 2012; 3/00/515656-12) 
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